US20030145233A1 - Architecture to thwart denial of service attacks - Google Patents
Architecture to thwart denial of service attacks Download PDFInfo
- Publication number
- US20030145233A1 US20030145233A1 US10/066,252 US6625202A US2003145233A1 US 20030145233 A1 US20030145233 A1 US 20030145233A1 US 6625202 A US6625202 A US 6625202A US 2003145233 A1 US2003145233 A1 US 2003145233A1
- Authority
- US
- United States
- Prior art keywords
- provisioned
- traffic
- monitor
- network
- links
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
- This invention relates to provisioned techniques to thwart network-related denial of service attacks.
- In denial of service attacks, an attacker sends a large volume of malicious traffic to a victim, e.g., victim data center. In one approach an attacker, via a computer system connected to the Internet infiltrates one or a plurality of computers at various data centers. Often the attacker will access the Internet through an Internet Service Provider (ISP). The attacker by use of a malicious software program places the plurality of computers at the data centers under its control. When the attacker issues a command to the computers at the data centers, the machines send data out of the data centers at arbitrary times. These computers can simultaneously send large volumes of data over various times to the victim data center preventing the victim from responding to legitimate traffic.
- According to an aspect of the invention, a monitoring device is disposed for thwarting denial of service attacks on a data center. The monitoring device collects statistical information on packets that are sent between a network and the data center for a plurality of customers by examining traffic as if the device was disposed on links that are downstream from links that the provisioned monitor is disposed on.
- According to an additional aspect of the invention, a method of thwarting denial of service attacks on a victim data center coupled to a network includes collecting statistical information on packets that are sent between a network and a plurality of customers of the data center by examining traffic as if the device was disposed on links that are downstream from links that the provisioned monitor is disposed on and communicating data, over a dedicated network, to a control center.
- According to an aspect of the invention, an arrangement is disposed to monitor a link between a data center and a network for thwarting denial of service attacks on the data center. The arrangement includes a provisioned monitor that collects statistical information for a plurality of provisioned customers, which are on links that are downstream from links that the provisioned monitor is disposed on, the provisioned monitor maintaining separate counter logs for each provisioned customer and a global counter log that accounts for all traffic seen on the link that the provisioned monitor is coupled to.
- According to an additional aspect of the invention, a method of thwarting denial of service attacks on a victim data center coupled to a network includes collecting statistical information for a plurality of provisioned customers on links that are downstream from links on which collecting occurs and maintaining separate counter logs for each provisioned customer, and a global counter log that accounts for all traffic seen on the links on which collecting occurs.
- According to a still further aspect of the invention, a method of thwarting denial of service attacks on a victim data center coupled to a network includes collecting statistical information for a plurality of links that are downstream from links on which collecting occurs and performing traffic analysis on the collected statistical information on a per downstream link basis to identify malicious traffic. The method also includes communicating alerts that arise from the traffic analysis.
- One or more aspects of the invention may provide one or all of the following advantages.
- Aspects of the invention provide a provisioned monitoring architecture to detect and determine packets that are part of a denial of service attack and provide monitoring capabilities for hosted customers equivalent to placing physical monitors on those hosted customers' individual access links. More generally, provisioned monitoring provides monitoring capabilities for many smaller links by analyzing traffic on a larger upstream link. Provisioned monitoring can be extended to other, e.g., in-line provisioned services, such as “provisioned traffic engineering” or “provisioned fire walling”.
- The details of one or more embodiments of the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.
- FIG. 1 is a block diagram of network having a provisioned architecture to thwart denial of service attacks
- FIG. 2 is a block diagram depicting an architecture of a provisioned, clustered gateway.
- FIG. 3 is a block diagram depicting processes that execute on a gateway cluster head.
- FIG. 4 is a block diagram depicting processes that execute on a probe.
- FIG. 5 is a flow chart depicting a joining process for a probe.
- FIG. 5A is a block diagram depicting functional details of the provisioned gateway.
- FIGS. 6A and 6B depict alternative arrangements for provisioned monitors.
- FIGS. 7A and 7B depict respectively probe and cluster head functionality.
- FIG. 8 is a flow chart depicting exemplary analysis processes in the cluster head.
- Referring to FIG. 1, an
arrangement 10 to thwart denial of service attacks (DoS attacks) is shown. Thearrangement 10 is used to thwart an attack on avictim data center 12, e.g., a web site or other network site under attack. Thevictim 12 is coupled to the Internet 14 or other network. For example, thevictim 12 has a web server located at a data center (not shown). - An attacker via a computer system (not shown) that is connected to the Internet e.g., via an Internet Service Provider (ISP) (not shown) or other approach, infiltrates one or a plurality of computers at various other sites or
data centers 20 a-20 c. The attacker by use of a malicious software program (not shown) that is generally surreptitiously loaded on the computers of the data centers 20 a-20 c, places the plurality of computers in the data centers 20 a-20 c under its control. When the attacker issues a command to the data centers 20 a-20 c, the data centers 20 a-20 c send data out at arbitrary times. These data centers 20 a-20 c can simultaneously send large volumes of data at various times to thevictim 12 to prevent thevictim 12 from responding to legitimate traffic. - The
arrangement 10 to protect the victim includes acontrol center 24 that communicates with and controls monitor devices, e.g.,gateways 26 anddata collectors 28 disposed in thenetwork 14. The arrangement protects against DoS attacks via intelligent traffic analysis and filtering that is distributed throughout the network. In some embodiments, thecontrol center 24 is coupled to thegateways 26 anddata collectors 28 by a hardened,redundant network 30. In preferred embodiments, the network is inaccessible to the attacker. Thegateway 26 devices are located at the edges of the Internet 14, for instance, at the entry points of data centers. The gateway devices constantly analyze traffic, looking for congestion or traffic levels that indicate the onset of a DoS attack. Thedata collectors 28 are located inter alia at major peering points, data centers and network points of presence (PoPs). Thedata collectors 28 sample packet traffic, accumulate, and collect statistical information about network flows. - Some or all of the deployed monitor devices in the arrangement are provisioned monitors. Such provisioned monitors can include provisioned gateways and provisioned data collectors that are linked to the
central control center 24. As shown in FIG. 1, thegateway 26 is a provisioned device and is hereinafter referred to as provisionedgateway 26. However, thedata collectors 28 could also be provisioned devices. Further, thearrangement 10 could be comprised of provisioned and nonprovisioned devices. - The
control center 24 aggregates traffic information and coordinates measures to track down and block the sources of an attack. In one embodiment, the arrangement uses a distributed analysis emphasizing the underlying characteristics of a DoS attack, i.e., congestion and slow server response, to produce a robust and comprehensive DoS solution. Thus, thisarchitecture 10 can stop new attacks rather than some solutions that can only stop previously seen attacks. Furthermore, thedistributed architecture 10 will frequently stop an attack near its source, before it uses bandwidth on the wider Internet 14 or congests access links to the targetedvictim 12. - The provisioned
gateway 26 can be a single device, e.g. a data collector or gateway, or as described in FIG. 2 a clustered device that can monitor a plurality of links. One example of a clustered device is theclustered gateway 26. The clustered gateway is used to monitor a plurality of links that exist between thevictim center 12 and the Internet 14. The provisioned, clusteredgateway 26 is placed on selected links in the data center so that it examines all traffic entering or leaving that data center. Thegateway 26 also examines all of the traffic to or from a particular data center customer (“hosted customer”) or an individual host or group of hosts. - The provisioned monitor, e.g.,
gateway 26 logically analyzes traffic on a link or links so as to provide monitoring capabilities for hosted customers C1 equivalent to what could be obtained by placing physical monitors on those hosted customers' individual access links. The provisionedgateway 26 provides monitoring capabilities for many smaller links in the data center by analyzing traffic on a larger upstream link. - Referring now to FIG. 2, the
data center 20 has a plurality of links 21 a-21 n with theInternet 14. Each customer Ci (0<=i<N, for N customers) of the data center is associated with a set of addresses Ai. The provisioned monitor has a notion of inbound and outbound packets, obtained directly from the physical link's transmit and receive ports. Any inbound packet with a destination address in Ai is interpreted as inbound to customer Ci. Every outbound packet with a source address of Ai is interpreted as outbound from customer Ci. Inbound or outbound packets with other addresses (e.g., addresses that are not in the address space Ai for any customer i) are classified as “other”. Inbound packets with unknown destination addresses may be destined to customers that have not been provisioned. Outbound packets with unknown source addresses may be coming from customers that have not been provisioned, or they may be part of a spoofing attack. - A service provider that provides a provisioned
monitor 26 could perform ingress filtering on traffic entering its network from customers downstream of the provisioned monitor. In this way, any outbound packets with unknown source addresses (not in any address of address space Ai) are considered to be originating from unprovisioned customers rather than being part of a spoofed DoS attack. - The links exist through various network architectural arrangements, the details of which are not an important consideration here. The provisioned customers Ci's of the
data center 20 are protected by the clusteredgateway 26. The clusteredgateway 26 includes a plurality ofprobe devices 26 a-26 n, which are here shown coupled in-line with the links between thedata center 20 and theInternet 14. Theprobe devices 26 a-26 n have connections to ahead gateway device 27. - The
cluster head device 27 likewise can have an optional and/or hardened redundant network interface connection to a hardened/redundant network 30. This interface is used to connect thehead gateway device 27 to the control center 24 (FIG. 1) or to allow operator access to the cluster. -
Probes 26 a-26 n perform several functions such as sampling of packets and collect information pertaining to statistical properties of the packets. In preferred embodiments, theprobes 26 a-26 n examine every packet for statistical analysis purposes and randomly choose selected numbers of packets per second to pass to thecluster head 27. Thecluster head 27 is responsible for receiving the sampled traffic packets and summary information provided from theprobes 26 a-26 n. Thecluster head 27 analyzes the traffic for detection of denial of service attacks using any known algorithms or the algorithms described below. The analysis is performed for each Ci's traffic as well as for the entire link. - Each provisioned customer's virtual monitor e.g. virtual monitors Vma, Vmb, Vmc and Vmd for clients Ca-Cd, are configured with a set of thresholds and other parameters like those of a normal physical monitor. Customer Ca's virtual monitor's heuristics are based on traffic that has been classified as being sent to or originating from customer Ca, as described above. Other customers have virtual monitor heuristics classified based on traffic for that customer.
- The provisioned monitor also provides all the features of a standard monitor for the link on which the monitor is deployed. The provisioned monitor includes all of the analysis capabilities of a standard monitor deployed on the same link.
- The
cluster head 27 also provides auser interface 29 into the traffic analysis and also communicates with thecontrol center 24. The provisionedgateway 26, configured for N customers provides N+2 user interfaces. These interfaces are one interface for each provisioned customer, one interface for the link(s) on which the monitor is physically deployed, and one “management interface.” The customer and link interfaces are similar to those of a traditional physical monitor. The link interfaces provide the same data as a non-provisioned monitor in the same location. The management interface allows the hosting provider to oversee the status of all provisioned customers on one screen. - The
cluster head 27 is connected to theprobes 26 a-26 n. In one embodiment, a network type of connection provides connectivity between thecluster head 27 andprobes 26 a-26 n. An exemplary type of network connection is a 100 Mbit Ethernet network. Other connections and other network configurations, of course, could be used. Preferably this connection is a private network used only for inter-cluster communications. As aprobe 26 a-26 n starts up and joins the cluster, it obtains an IP address on the network and begins sending sample packets and statistical information to thecluster head 27 as will be described below. - The arrangement provides a straightforward manner to set up a cluster topology. The arrangement does not need a leader election protocol. Rather, a
single cluster head 27 is used per cluster with all other probes as members. Thecluster head 27 need not know explicitly about any particular cluster member. When a new cluster member is added to a cluster, the new cluster member can dynamically discover its cluster head and join the cluster. The cluster head will allow/deny the member to join the cluster. The cluster head will keep a minimal amount of information for each member of the cluster to facilitate debugging and analysis. - The links between cluster heads and members can be fast connections, e.g., 100 Mbs Ethernet. To achieve this a cluster member must be on the same IP network as the cluster head. In some embodiments, the DHCP protocol can be used whereas, in others a Cluster Discovery Protocol (CDP) described below can be used.
- Referring now to FIG. 3,
exemplary processes 50 that run on acluster head 27 are shown. Thecluster head 27 will include a server level configuration process 52 and a user level configuration process 54. The server level 52 configuration process in one implementation can be a Click server process, as described in the Appendix. The server level configuration process aggregates 52 traffic fromvarious probes 26 a-26 n. The user-level configuration process 54 produces logs and runs detection algorithms. Thecluster head 27 also includes a HTTP server orweb server 56 such as an Apache server, as well as a time synchronization process such as NTP (network time protocol) 58. Thecluster head 27 also includes aprocess 60 to allow the server to automatically assign an IP address to the probe. One example of such a process is the DHCP, e.g., dynamic host configuration protocol, which is a network protocol that enables an DHCP server to automatically assign an IP address to individual computers. - Referring now to FIG. 4,
exemplary processes 70 that execute onprobe 26 a are shown. Theprobe 26 a executes a joiningprocess 72 to permit theprobe 26 a to join an existing, operating cluster. Theprobe 26 a also includes amonitor process 74 that monitors packets that pass through theprobe 26 a in an implementation where theprobe 26 a is disposed in-line between the data center and the Internet. Theprobe 26 a also executes apacket flow process 76 that statistically samples random packets and sends those packets to thehead server 27. - Referring to FIG. 5, the joining
process 72 on theprobes 26 a-216 n, is shown forprobe 26 a. During the joiningprocess 72 the probe is booted 82. Once the probe boots, the probe executes a script. The script installs 84 kernel Click config (which is shown as 74 and 76 in FIG. 4), and runs a DHCP client application) to obtain a IP address from the cluster head. Once the IP address is assigned, thejoin process 72 will start 88 a NTP (Network Time Protocol, or equivalent) synchronization process between cluster head and probe to allow the probe to maintain the same time as other probes in the cluster, as well as thecluster head 27. After theNTP synchronization process 88, theprocess 72 configures 90 the monitor configuration in the Click kernel to enable the probe to collect statistical information concerning traffic flow to the probe, e.g., 26 a, as well as to sample selected numbers of packets to send to thecluster head 27. - A probe can have a serial port for debugging/configuring that is accessed via the cluster network.
- Referring to FIG. 5A, the provisioned
gateway 26 stores both sampled packet logs, for detailed traffic analysis and forensic information, and counter logs (time series statistics about different kinds of traffic), for quick access to frequently needed data. Each provisioned monitor keeps separate counter logs 52 a-52 d for each provisioned customer (virtual monitor), as well as a global counter log 52 that accounts for all traffic seen on the link. In an alternate embodiment the clustered gateways keep oneglobal packet log 53. Theglobal packet log 53 includes a sample of all traffic seen on a link. Packet analysis for a particular virtual monitor happens by classifying packets based on addresses at the time of the analysis. Another embodiment (not shown) maintains duplicate packets, keeping both a global packet log and one log for each virtual monitor, potentially improving analysis speeds at the expense of more computation during data collection. This alternative may be less desirable because one can expect that analysis will happen infrequently relative to data collection. - Referring to FIGS. 6A and 6B, two alternatives for a provisioned monitor (shown as a gateway26) in a distributed approach are shown. In FIG. 6A, each of the virtual monitors 52 a-52 d (including the one for the physical link on which the provisioned monitor is deployed) acts as independent node in the network. In this alternative, the provisioned monitor 52 a-52 d can issue attack warnings and responses to attack queries independently from other virtual monitors 52 a-52 d in the clustered
gateway 26. This approach makes virtual monitors invisible to the network, but incurs extra overhead due to multiple communication and attack query/response processes to/from acontrol center 24 for example. Also, it does not provide a mechanism by which the hosting provider operating the provisioned monitor can be informed of attacks to or from a particular provisioned customer. Further, if the provider that is implementing provisioned monitoring does not also implement ingress filtering on traffic entering its network from provisioned customers, then spoofing may cause a virtual monitor to incorrectly report a particular provisioned customer as the source of the attack. - In FIG. 6B, another approach has the provisioned monitor, e.g., provisioned clustered
gateway 26, including all its virtual monitors 52 a-52 d acting as a single node in the distributed network. In this approach the provisioned monitor e.g.,gateway 26 acts as an intermediary between virtual monitors 52 a-52 d and the rest of the network and communicates through one communication process “com”. This approach makes better use of computational resources on the monitor. Only one process is required to maintain communications withcontrol center server 24 and to reply to attack queries. When a virtual monitor detects an attack on a provisioned customer, information is conveyed both to theNOC server 24 and to the hosting provider's management interface (not shown). In this scenario, thecenter server 24 is adapted to distinguish an attack on a single provisioned customer (associated with a virtual monitor) from an attack on the link(s) on which the monitor is physically deployed. An alternative implementation could use a combination of the two approaches. - Referring now to FIGS. 7A and 7B, exemplary operational process that can occur on one or
more probes 26 a-26 n and thecluster head 27 are shown. On the probes a process 100 (FIG. 7A) is used to sample 102 one in every N packets or to provide a random sampling of said packets. Theprocess 100 also collects 104 and logs source information from all packets and will collect and log 106 destination information from all packets. Theprocess 100 also collects information regarding the packet type and so forth. At respective points in time, theprocess 100 will transmit 108 the collected and logged destination and source information as well as other statistical information to thecluster head 27 and will likewise transmit sample packets to thecluster head 27. - Referring to FIG. 7B, a
process 110 is shown that executes on thecluster head 27. Theprocess 110 includes aprocess 112 to analyze collected source and destination information and to determine 114 whether or not the information corresponds to an attack on the victim center. If the information corresponds to an attack, theprocess 110 generates 116 a response to the attack. Exemplary responses can be to send a message to thedata center 24 that an attack is underway. Optionally, a response can involve determining the nature of the attack and source of the attack at the gateway. In this option, thegateway 26 can determine corrective measures such as installing filters on nearby routers or by installing a filter in one or more of theprobes 26 a-26 n (if the probes are in-line). These filters block undesired network traffic as will be discussed below. - The
cluster head 27 makes decisions about the health of the traffic passing by thecluster 26 and keeps logs (not shown) of the traffic. To do this thecluster head 27 examines a subset of the packets flowing by the cluster members, and the counters obtained fromprobes 26 a-26 n. Thecluster head 27 uses the counter information and sampled packets to determine if acluster 26 is involved in an attack and the traffic subset will be used for logging. - With an implementation using Click, all information is contained in packets. Thus, packets are delivered from
cluster probes 26 a-26 n to acluster head 27. This can present a problem since the system needs to both maintain contents (including annotations) of a packet as it is transported fromprobe 26 a-26 n to head 27, and needs to distinguish different types of packets at thecluster head 27. - One specific implementation to solve these problems includes four Click elements: IPEncap, IPClassifier, PackWithAnno, and UnpackWithAnno. Also, reliable queue {Rx, Tx} is used for reliable delivery.
- The traffic on the intra-cluster network would include:
- NTP traffic: for time synchronization (bi-directional)
- DHCP traffic: for IP address management (bi-directional)
- RSH protocol a bi-directional protocol for probe traffic.
- IP protocol127: randomly sampled packets (probe to cluster head)
- IP protocol128: counter summary log packets (probe to cluster head)
- The specific traffic flows can be bi-directional and are encapsulated via the PackWithAnno element on the probe and decapsulated with the UnpackeWithAnno element at the cluster head. Note that the packets are raw IP packets, i.e., the packets do not run over a user datagram or Transport UDP/TCP. With this deliver process packet size is watched carefully so as to not exceed the MTU. As exemplary parameters, the counter summary packets can be sent once per second, the TCP monitoring packets can be sent twice per report. Sampled packets are sent according to a sampling rate set for the probe. An exemplary setting is 10,000 PPS although slower or faster rates could be used. The sample packets produce the logs mentioned above. The counter summary log packets and the TCP rate monitor packets are used in attack detection heuristics. The traffic rate on the intra-cluster network should be predictable regardless of the traffic rate the cluster itself is seeing. This prevents dos attacks from loading the cluster's network. With the parameter values mentioned above the predicted traffic per probe rates: 10,000 (sample)+1 (counter summary)+2 (IP Rate monitor). The NTP and DHCP packet loads are negligible.
- The
gateway 26 monitoring process 74 (FIG. 4) monitors traffic that passes through the gateway and includes a communication process (not shown) that communicates statistics collected in thegateway 26 with thedata center 24. Thegateway 26 uses a separate interface over a private, redundant network, such as amodem 39 over the telephone network or a leased line, a network adapter over a LAN, etc. to communicate with thecontrol center 24. Other interface types are possible. In addition, thegateway 26 can include processes (not shown) to allow an administrator to insert filters to block, i.e., discard packets that the device deems to be part of an attack, as determined by heuristics described below. - Referring to FIG. 8,
exemplary techniques 130 to determine if a data center is under attack are shown. Thegateway 26 collectsstatistics 132 and analyzes the statistics according to one or more of the algorithms 134 a-134 e described below. Other algorithms can be used. - Several methods can be used separately or in combination to detect malicious traffic flows. For example, the
gateway 26 can detect DoS attacks using at least one or more of the following methods including: analyzing packet ratios of TCP-like traffic; analyzing “repressor” traffic for particular types of normal traffic; performing TCP handshake analysis; performing various types of packet analysis at packet layers 3-7; and logging/historical analysis. - Packet Ratios for TCP-
Like Traffic 134 a. - The Transmission Control Protocol (TCP) is a protocol in which a connection between two hosts, a client C, e.g. a web browser, and a server S, e.g. a web server, involves packets traveling in both directions, between C and S and between S and C. When C sends data to S and S receives it, S replies with an ACK (“acknowledgement”) packet. If C does not receive the ACK, it will eventually try to retransmit the data to S, to implement TCP's reliable delivery property. In general, a server S will acknowledge (send an ACK) for every packet or every second packet.
- The monitoring process in the
gateway 26 can examine a ratio of incoming to outgoing TCP packets for a particular set of machines, e.g. web servers. The monitoring process can compare the ratio to a threshold value. The monitoring process can store this ratio, time stamp it, etc. and conduct an ongoing analysis to determine over time for example how much and how often it exceeds that ratio. As the ratio grows increasingly beyond 2:1, e.g., up to about 3:1 or so, it is an increasing indication that the machines are receiving bad TCP traffic, e.g., packets that are not part of any established TCP connection, or that they are too overloaded to acknowledge the requests. - The monitoring process can monitor rates as bytes/sec and packets/sec rates of total, UDP, ICMP, and fragmented traffic in addition to TCP traffic. The thresholds are set manually by an operator. In some embodiments the device can provide a “threshold wizard” which uses historical data to help the user to set thresholds. An alternate implementation could automatically generate time-based thresholds using historical data.
- Another alternate implementation could combine thresholds with a histogram analysis, and trigger traffic characterization whenever a histogram for some parameter differed significantly (by a uniformity test, or for example, by subtracting normalized histograms) from the historical histogram.
- The
gateway 26 divides traffic into multiple buckets, e.g. by source network address, and tracks the ratio of ingoing to outgoing traffic for each bucket. As the ratio for one bucket becomes skewed, thegateway 26 may subdivide that bucket to obtain a more detailed view. Thegateway 26 raises 90 a warning or alarm to thedata center 24 and/or to the administrators at thevictim site 12. -
Repressor Traffic 134 b. - The phrase “repressor traffic” as used herein refers to any network traffic that is indicative of problems or a potential attack in a main flow of traffic. A
gateway 26 may use repressor traffic analysis to identify such problems and stop or repress a corresponding attack. - One example of repressor traffic is ICMP port unreachable messages. These messages are generated by an end host when the end host receives a packet on a port that is not responding to requests. The message contains header information from the packet in question. The
gateway 26 can analyze the port unreachable messages and use them to generate logs for forensic purposes or to selectively block future messages similar to the ones that caused the ICMP messages. -
TCP Handshake Analysis 134 c. - A TCP connection between two hosts on the network is initiated via a three-way handshake. The client, e.g. C, sends the server, e.g. S, a SYN (“synchronize”) packet. S the server replies with a SYN ACK (“synchronize acknowledgment”) packet. The client C replies to the SYN ACK with an ACK (“acknowledgment”) packet. At this point, appropriate states to manage the connection are established on both sides.
- During a TCP SYN flood attack, a server is sent many SYN packets but the attacking site never responds to the corresponding SYN ACKs with ACK packets. The resulting “half-open” connections take up state on the server and can prevent the server from opening up legitimate connections until the half-open connection expires, which usually takes 2-3 minutes. By constantly sending more SYN packets, an attacker can effectively prevent a server from serving any legitimate connection requests.
- One type of attack occurs during connection setup. At setup the gateway forwards a SYN packet from the client to the server. The gateway forwards a resulting SYN ACK packet from a server to client and immediately sends ACK packet to the server, closing a three-way handshake. The gateway maintains the resulting connection for a variable timeout period. If the packet does not arrive from client to server, the gateway sends a RST (“reset”) to the server to close the connection. If the ACK arrives, gateway forwards the ACK and forgets about the connection, forwarding subsequent packets for that connection. The variable timeout period can be inversely proportional to number of connections for which a first ACK packet from client has not been received. In a passive configuration, a
cluster 26 can keep track of ratios of SYNs to SYN ACKs and SYN ACKs to ACKs, and raise appropriate alarms when a SYN flood attack situation occurs. - Layer3-7
Analysis 134 d. - With layer3-7 analysis, the
gateway 26 looks at various traffic properties at network packet layers 3 through 7 to identify attacks and malicious flows. These layers are often referred to as layers of the Open System Interconnection (OSI) reference model and are network, transport, session, presentation and application layers respectively. Some examples of characteristics that the gateway may look for include: - 1. Unusual amounts of IP fragmentation, or fragmented IP packets with bad or overlapping fragment offsets.
- 2. IP packets with obviously bad source addresses, or ICMP packets with broadcast destination addresses.
- 3. TCP or UDP packets to unused ports.
- 4. TCP segments advertising unusually small window sizes, which may indicate load on server, or TCP ACK packets not belonging to a known connection.
- 5. Frequent reloads that are sustained at a rate higher than plausible for a human user over a persistent HTTP connection.
- The monitoring process determines the rates or counts of these events. If any of the rates/counts exceeds a particular threshold, the cluster device considers this a suspicious event and begins attack characterization process.
- Several attack characterization processes can be used. One type in particular uses histograms to characterize the type of attack that was detected. Co-pending U.S. patent application Ser. No. ______ Filed on ______, and entitled “DENIAL OF SERVICE ATTACKS CHARACTERIZATION”, which is assigned to the assignee of the present invention and incorporated herein by reference.
- Logging and
Historical Traffic Analysis 134 e. - The
gateways 26 anddata collectors 28 keep statistical summary information of traffic over different periods of time and at different levels of detail. For example, agateway 26 may keep mean and standard deviation for a chosen set of parameters across a chosen set of time-periods. The parameters may include source and destination host or network addresses, protocols, types of packets, number of open connections or of packets sent in either direction, etc. Time periods for statistical aggregation may range from minutes to weeks. The device will have configurable thresholds and will raise warnings when one of the measured parameters exceeds the corresponding threshold. - The
gateway 26 can also log packets. In addition to logging full packet streams, thegateway 26 has the capability to log only specific packets identified as part of an attack (e.g., fragmented UDP packets or TCP SYN packets that are part of a SYN flood attack). This feature of thegateway 26 enables administrators to quickly identify the important properties of the attack. - Alternatively, a
gateway 26 can tap a network line without being deployed physically in line, and it can control network traffic, for example, by dynamically installing filters on nearby routers. Thegateway 26 would install these filters on the appropriate routers via an out of band connection, i.e. a serial line or a dedicated network connection. Other arrangements are of course possible. - Aspects of the processes described herein can use “Click,” a modular software router system developed by The Massachusetts Institute of Technology's Parallel and Distributed Operating Systems group. A Click router is an interconnected collection of modules or elements used to control a router's behavior when implemented on a computer system. Other implementations can be used.
- Other embodiments are within the scope of the appended claims. For example, the provisioned monitors were described as operating on inbound traffic to thwart or protect a victim data center. Alternatively, the same approach can be used to operate on outbound traffic to attempt to stop malicious traffic from leaving a site that is involved in a denial of service attack on another site.
Claims (33)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/066,252 US7657934B2 (en) | 2002-01-31 | 2002-01-31 | Architecture to thwart denial of service attacks |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/066,252 US7657934B2 (en) | 2002-01-31 | 2002-01-31 | Architecture to thwart denial of service attacks |
Publications (2)
Publication Number | Publication Date |
---|---|
US20030145233A1 true US20030145233A1 (en) | 2003-07-31 |
US7657934B2 US7657934B2 (en) | 2010-02-02 |
Family
ID=27610456
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/066,252 Active 2028-06-20 US7657934B2 (en) | 2002-01-31 | 2002-01-31 | Architecture to thwart denial of service attacks |
Country Status (1)
Country | Link |
---|---|
US (1) | US7657934B2 (en) |
Cited By (80)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030145231A1 (en) * | 2002-01-31 | 2003-07-31 | Poletto Massimiliano Antonio | Architecture to thwart denial of service attacks |
US20030189904A1 (en) * | 2002-04-04 | 2003-10-09 | Li Jonathan Q. | Sampling fractal internet protocol traffic with bounded error tolerance and response time |
US20050027854A1 (en) * | 2003-07-29 | 2005-02-03 | International Business Machines Corporation | Method, program and system for automatically detecting malicious computer network reconnaissance |
US20060010389A1 (en) * | 2004-07-09 | 2006-01-12 | International Business Machines Corporation | Identifying a distributed denial of service (DDoS) attack within a network and defending against such an attack |
US20060075084A1 (en) * | 2004-10-01 | 2006-04-06 | Barrett Lyon | Voice over internet protocol data overload detection and mitigation system and method |
US20060107318A1 (en) * | 2004-09-14 | 2006-05-18 | International Business Machines Corporation | Detection of grid participation in a DDoS attack |
US20060221844A1 (en) * | 2005-04-05 | 2006-10-05 | Cisco Technology, Inc. | Method and system for determining path maximum transfer unit for IP multicast |
US20080117918A1 (en) * | 2004-10-22 | 2008-05-22 | Satoshi Kobayashi | Relaying Apparatus and Network System |
US20080147499A1 (en) * | 2006-12-15 | 2008-06-19 | Fraudwall Technologies, Inc. | Network interaction correlation |
US20080147847A1 (en) * | 2006-12-15 | 2008-06-19 | Fraudwall Technologies, Inc. | Network interaction analysis |
US20080183623A1 (en) * | 2007-01-29 | 2008-07-31 | Zhangwei Xu | Secure Provisioning with Time Synchronization |
US20080189409A1 (en) * | 2006-12-15 | 2008-08-07 | Fraudwall Technologies, Inc. | Network interaction monitoring appliance |
US20080256239A1 (en) * | 2000-03-21 | 2008-10-16 | F5 Networks, Inc. | Method and system for optimizing a network by independently scaling control segments and data flow |
US20090037208A1 (en) * | 2007-08-03 | 2009-02-05 | Fraudwall Technologies, Inc. | Using a reason code to indicate a reason for a rating of a network interaction |
US20090119722A1 (en) * | 2007-11-01 | 2009-05-07 | Versteeg William C | Locating points of interest using references to media frames within a packet flow |
US20090116402A1 (en) * | 2004-10-21 | 2009-05-07 | Nec Corporation | Communication quality measuring apparatus and communication quality measuring method |
US20090217318A1 (en) * | 2004-09-24 | 2009-08-27 | Cisco Technology, Inc. | Ip-based stream splicing with content-specific splice points |
US7587485B1 (en) * | 2002-09-19 | 2009-09-08 | Foundry Networks, Inc. | System and method for supplicant based accounting and access |
US20110131654A1 (en) * | 2009-11-30 | 2011-06-02 | Varun Taneja | Systems and methods for aggressive window probing |
US20110191469A1 (en) * | 2007-05-14 | 2011-08-04 | Cisco Technology, Inc. | Tunneling reports for real-time internet protocol media streams |
US20120137366A1 (en) * | 2005-11-14 | 2012-05-31 | Cisco Technology, Inc. | Techniques for network protection based on subscriber-aware application proxies |
US8806053B1 (en) | 2008-04-29 | 2014-08-12 | F5 Networks, Inc. | Methods and systems for optimizing network traffic using preemptive acknowledgment signals |
US8804504B1 (en) | 2010-09-16 | 2014-08-12 | F5 Networks, Inc. | System and method for reducing CPU load in processing PPP packets on a SSL-VPN tunneling device |
US8868961B1 (en) | 2009-11-06 | 2014-10-21 | F5 Networks, Inc. | Methods for acquiring hyper transport timing and devices thereof |
US8886981B1 (en) | 2010-09-15 | 2014-11-11 | F5 Networks, Inc. | Systems and methods for idle driven scheduling |
US20140351931A1 (en) * | 2012-09-06 | 2014-11-27 | Dstillery, Inc. | Methods, systems and media for detecting non-intended traffic using co-visitation information |
US8908545B1 (en) | 2010-07-08 | 2014-12-09 | F5 Networks, Inc. | System and method for handling TCP performance in network access with driver initiated application tunnel |
US8959571B2 (en) | 2010-10-29 | 2015-02-17 | F5 Networks, Inc. | Automated policy builder |
US8978138B2 (en) | 2013-03-15 | 2015-03-10 | Mehdi Mahvi | TCP validation via systematic transmission regulation and regeneration |
US9083760B1 (en) | 2010-08-09 | 2015-07-14 | F5 Networks, Inc. | Dynamic cloning and reservation of detached idle connections |
US9141625B1 (en) | 2010-06-22 | 2015-09-22 | F5 Networks, Inc. | Methods for preserving flow state during virtual machine migration and devices thereof |
US9172753B1 (en) | 2012-02-20 | 2015-10-27 | F5 Networks, Inc. | Methods for optimizing HTTP header based authentication and devices thereof |
US9197362B2 (en) | 2013-03-15 | 2015-11-24 | Mehdi Mahvi | Global state synchronization for securely managed asymmetric network communication |
US9231879B1 (en) | 2012-02-20 | 2016-01-05 | F5 Networks, Inc. | Methods for policy-based network traffic queue management and devices thereof |
US9246819B1 (en) | 2011-06-20 | 2016-01-26 | F5 Networks, Inc. | System and method for performing message-based load balancing |
US9270766B2 (en) * | 2011-12-30 | 2016-02-23 | F5 Networks, Inc. | Methods for identifying network traffic characteristics to correlate and manage one or more subsequent flows and devices thereof |
US20160134646A1 (en) * | 2014-11-06 | 2016-05-12 | Cisco Technology, Inc. | Method and apparatus for detecting malicious software using handshake information |
US9554276B2 (en) | 2010-10-29 | 2017-01-24 | F5 Networks, Inc. | System and method for on the fly protocol conversion in obtaining policy enforcement information |
US20170230393A1 (en) * | 2013-06-14 | 2017-08-10 | Damballa, Inc. | Systems and methods for traffic classification |
US9894088B2 (en) | 2012-08-31 | 2018-02-13 | Damballa, Inc. | Data mining to identify malicious activity |
US9922190B2 (en) | 2012-01-25 | 2018-03-20 | Damballa, Inc. | Method and system for detecting DGA-based malware |
US9930065B2 (en) | 2015-03-25 | 2018-03-27 | University Of Georgia Research Foundation, Inc. | Measuring, categorizing, and/or mitigating malware distribution paths |
US9948671B2 (en) | 2010-01-19 | 2018-04-17 | Damballa, Inc. | Method and system for network-based detecting of malware from behavioral clustering |
US10015286B1 (en) | 2010-06-23 | 2018-07-03 | F5 Networks, Inc. | System and method for proxying HTTP single sign on across network domains |
US10015143B1 (en) | 2014-06-05 | 2018-07-03 | F5 Networks, Inc. | Methods for securing one or more license entitlement grants and devices thereof |
US10027688B2 (en) | 2008-08-11 | 2018-07-17 | Damballa, Inc. | Method and system for detecting malicious and/or botnet-related domain names |
US10044748B2 (en) | 2005-10-27 | 2018-08-07 | Georgia Tech Research Corporation | Methods and systems for detecting compromised computers |
USRE47019E1 (en) | 2010-07-14 | 2018-08-28 | F5 Networks, Inc. | Methods for DNSSEC proxying and deployment amelioration and systems thereof |
US10084806B2 (en) | 2012-08-31 | 2018-09-25 | Damballa, Inc. | Traffic simulation to identify malicious activity |
US10097616B2 (en) | 2012-04-27 | 2018-10-09 | F5 Networks, Inc. | Methods for optimizing service of content requests and devices thereof |
US10122630B1 (en) | 2014-08-15 | 2018-11-06 | F5 Networks, Inc. | Methods for network traffic presteering and devices thereof |
US10135831B2 (en) | 2011-01-28 | 2018-11-20 | F5 Networks, Inc. | System and method for combining an access control system with a traffic management system |
US10182013B1 (en) | 2014-12-01 | 2019-01-15 | F5 Networks, Inc. | Methods for managing progressive image delivery and devices thereof |
US10187317B1 (en) | 2013-11-15 | 2019-01-22 | F5 Networks, Inc. | Methods for traffic rate control and devices thereof |
US10230566B1 (en) | 2012-02-17 | 2019-03-12 | F5 Networks, Inc. | Methods for dynamically constructing a service principal name and devices thereof |
US10235677B1 (en) | 2006-12-15 | 2019-03-19 | Comscore, Inc. | Determination and application of click quality |
US10257212B2 (en) | 2010-01-06 | 2019-04-09 | Help/Systems, Llc | Method and system for detecting malware |
US10375155B1 (en) | 2013-02-19 | 2019-08-06 | F5 Networks, Inc. | System and method for achieving hardware acceleration for asymmetric flow connections |
US10404698B1 (en) | 2016-01-15 | 2019-09-03 | F5 Networks, Inc. | Methods for adaptive organization of web application access points in webtops and devices thereof |
US10505792B1 (en) | 2016-11-02 | 2019-12-10 | F5 Networks, Inc. | Methods for facilitating network traffic analytics and devices thereof |
US10505818B1 (en) | 2015-05-05 | 2019-12-10 | F5 Networks. Inc. | Methods for analyzing and load balancing based on server health and devices thereof |
US10547674B2 (en) | 2012-08-27 | 2020-01-28 | Help/Systems, Llc | Methods and systems for network flow analysis |
US10708294B2 (en) * | 2017-01-19 | 2020-07-07 | Arbor Networks, Inc. | System and method to select and apply hypothetical mitigation parameters |
US10721269B1 (en) | 2009-11-06 | 2020-07-21 | F5 Networks, Inc. | Methods and system for returning requests with javascript for clients before passing a request to a server |
US10791088B1 (en) | 2016-06-17 | 2020-09-29 | F5 Networks, Inc. | Methods for disaggregating subscribers via DHCP address translation and devices thereof |
US10797888B1 (en) | 2016-01-20 | 2020-10-06 | F5 Networks, Inc. | Methods for secured SCEP enrollment for client devices and devices thereof |
US10812266B1 (en) | 2017-03-17 | 2020-10-20 | F5 Networks, Inc. | Methods for managing security tokens based on security violations and devices thereof |
US10834065B1 (en) | 2015-03-31 | 2020-11-10 | F5 Networks, Inc. | Methods for SSL protected NTLM re-authentication and devices thereof |
US10868828B2 (en) * | 2018-03-19 | 2020-12-15 | Fortinet, Inc. | Mitigation of NTP amplification and reflection based DDoS attacks |
US10972453B1 (en) | 2017-05-03 | 2021-04-06 | F5 Networks, Inc. | Methods for token refreshment based on single sign-on (SSO) for federated identity environments and devices thereof |
US11044200B1 (en) | 2018-07-06 | 2021-06-22 | F5 Networks, Inc. | Methods for service stitching using a packet header and devices thereof |
US11063758B1 (en) | 2016-11-01 | 2021-07-13 | F5 Networks, Inc. | Methods for facilitating cipher selection and devices thereof |
US11122042B1 (en) | 2017-05-12 | 2021-09-14 | F5 Networks, Inc. | Methods for dynamically managing user access control and devices thereof |
US11122083B1 (en) | 2017-09-08 | 2021-09-14 | F5 Networks, Inc. | Methods for managing network connections based on DNS data and network policies and devices thereof |
US11178150B1 (en) | 2016-01-20 | 2021-11-16 | F5 Networks, Inc. | Methods for enforcing access control list based on managed application and devices thereof |
US11343237B1 (en) | 2017-05-12 | 2022-05-24 | F5, Inc. | Methods for managing a federated identity environment using security and access control data and devices thereof |
US11350254B1 (en) | 2015-05-05 | 2022-05-31 | F5, Inc. | Methods for enforcing compliance policies and devices thereof |
US11757946B1 (en) | 2015-12-22 | 2023-09-12 | F5, Inc. | Methods for analyzing network traffic and enforcing network policies and devices thereof |
US11838851B1 (en) | 2014-07-15 | 2023-12-05 | F5, Inc. | Methods for managing L7 traffic classification and devices thereof |
US11895138B1 (en) | 2015-02-02 | 2024-02-06 | F5, Inc. | Methods for improving web scanner accuracy and devices thereof |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7865954B1 (en) * | 2007-08-24 | 2011-01-04 | Louisiana Tech Research Foundation; A Division Of Louisiana Tech University Foundation, Inc. | Method to detect SYN flood attack |
US8707428B2 (en) | 2010-08-05 | 2014-04-22 | At&T Intellectual Property I, L.P. | Apparatus and method for defending against internet-based attacks |
Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6088804A (en) * | 1998-01-12 | 2000-07-11 | Motorola, Inc. | Adaptive system and method for responding to computer network security attacks |
US6119236A (en) * | 1996-10-07 | 2000-09-12 | Shipley; Peter M. | Intelligent network security device and method |
US6321338B1 (en) * | 1998-11-09 | 2001-11-20 | Sri International | Network surveillance |
US20020069356A1 (en) * | 2000-06-12 | 2002-06-06 | Kwang Tae Kim | Integrated security gateway apparatus |
US20020078382A1 (en) * | 2000-11-29 | 2002-06-20 | Ali Sheikh | Scalable system for monitoring network system and components and methodology therefore |
US20020083343A1 (en) * | 2000-06-12 | 2002-06-27 | Mark Crosbie | Computer architecture for an intrusion detection system |
US20030084323A1 (en) * | 2001-10-31 | 2003-05-01 | Gales George S. | Network intrusion detection system and method |
US6735702B1 (en) * | 1999-08-31 | 2004-05-11 | Intel Corporation | Method and system for diagnosing network intrusion |
US6895432B2 (en) * | 2000-12-15 | 2005-05-17 | Fujitsu Limited | IP network system having unauthorized intrusion safeguard function |
US7007299B2 (en) * | 2000-08-30 | 2006-02-28 | Citibank, N.A. | Method and system for internet hosting and security |
US7162737B2 (en) * | 2001-02-13 | 2007-01-09 | Stonesoft | Synchronization of security gateway state information |
-
2002
- 2002-01-31 US US10/066,252 patent/US7657934B2/en active Active
Patent Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6119236A (en) * | 1996-10-07 | 2000-09-12 | Shipley; Peter M. | Intelligent network security device and method |
US6088804A (en) * | 1998-01-12 | 2000-07-11 | Motorola, Inc. | Adaptive system and method for responding to computer network security attacks |
US6321338B1 (en) * | 1998-11-09 | 2001-11-20 | Sri International | Network surveillance |
US6735702B1 (en) * | 1999-08-31 | 2004-05-11 | Intel Corporation | Method and system for diagnosing network intrusion |
US20020069356A1 (en) * | 2000-06-12 | 2002-06-06 | Kwang Tae Kim | Integrated security gateway apparatus |
US20020083343A1 (en) * | 2000-06-12 | 2002-06-27 | Mark Crosbie | Computer architecture for an intrusion detection system |
US7007299B2 (en) * | 2000-08-30 | 2006-02-28 | Citibank, N.A. | Method and system for internet hosting and security |
US20020078382A1 (en) * | 2000-11-29 | 2002-06-20 | Ali Sheikh | Scalable system for monitoring network system and components and methodology therefore |
US6895432B2 (en) * | 2000-12-15 | 2005-05-17 | Fujitsu Limited | IP network system having unauthorized intrusion safeguard function |
US7162737B2 (en) * | 2001-02-13 | 2007-01-09 | Stonesoft | Synchronization of security gateway state information |
US20030084323A1 (en) * | 2001-10-31 | 2003-05-01 | Gales George S. | Network intrusion detection system and method |
Cited By (111)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8788665B2 (en) | 2000-03-21 | 2014-07-22 | F5 Networks, Inc. | Method and system for optimizing a network by independently scaling control segments and data flow |
US20080256239A1 (en) * | 2000-03-21 | 2008-10-16 | F5 Networks, Inc. | Method and system for optimizing a network by independently scaling control segments and data flow |
US9647954B2 (en) | 2000-03-21 | 2017-05-09 | F5 Networks, Inc. | Method and system for optimizing a network by independently scaling control segments and data flow |
US20030145231A1 (en) * | 2002-01-31 | 2003-07-31 | Poletto Massimiliano Antonio | Architecture to thwart denial of service attacks |
US20030189904A1 (en) * | 2002-04-04 | 2003-10-09 | Li Jonathan Q. | Sampling fractal internet protocol traffic with bounded error tolerance and response time |
US8041812B2 (en) | 2002-09-19 | 2011-10-18 | Foundry Networks, Llc | System and method for supplicant based accounting and access |
US7587485B1 (en) * | 2002-09-19 | 2009-09-08 | Foundry Networks, Inc. | System and method for supplicant based accounting and access |
US20100023618A1 (en) * | 2002-09-19 | 2010-01-28 | Foundry Networks, Inc. | System and method for supplicant based accounting and access |
US20050027854A1 (en) * | 2003-07-29 | 2005-02-03 | International Business Machines Corporation | Method, program and system for automatically detecting malicious computer network reconnaissance |
US7356587B2 (en) * | 2003-07-29 | 2008-04-08 | International Business Machines Corporation | Automatically detecting malicious computer network reconnaissance by updating state codes in a histogram |
US20080148406A1 (en) * | 2003-07-29 | 2008-06-19 | International Business Machines Corporation | Automatically detecting malicious computer network reconnaissance by updating state codes in a histogram |
US7734776B2 (en) | 2003-07-29 | 2010-06-08 | International Business Machines Corporation | Automatically detecting malicious computer network reconnaissance by updating state codes in a histogram |
US20060010389A1 (en) * | 2004-07-09 | 2006-01-12 | International Business Machines Corporation | Identifying a distributed denial of service (DDoS) attack within a network and defending against such an attack |
US20060107318A1 (en) * | 2004-09-14 | 2006-05-18 | International Business Machines Corporation | Detection of grid participation in a DDoS attack |
US8423645B2 (en) * | 2004-09-14 | 2013-04-16 | International Business Machines Corporation | Detection of grid participation in a DDoS attack |
US9633202B2 (en) | 2004-09-14 | 2017-04-25 | International Business Machines Corporation | Managing a DDoS attack |
US9197857B2 (en) | 2004-09-24 | 2015-11-24 | Cisco Technology, Inc. | IP-based stream splicing with content-specific splice points |
US20090217318A1 (en) * | 2004-09-24 | 2009-08-27 | Cisco Technology, Inc. | Ip-based stream splicing with content-specific splice points |
US20060075491A1 (en) * | 2004-10-01 | 2006-04-06 | Barrett Lyon | Network overload detection and mitigation system and method |
US7478429B2 (en) | 2004-10-01 | 2009-01-13 | Prolexic Technologies, Inc. | Network overload detection and mitigation system and method |
US20060075084A1 (en) * | 2004-10-01 | 2006-04-06 | Barrett Lyon | Voice over internet protocol data overload detection and mitigation system and method |
US20090116402A1 (en) * | 2004-10-21 | 2009-05-07 | Nec Corporation | Communication quality measuring apparatus and communication quality measuring method |
US20080117918A1 (en) * | 2004-10-22 | 2008-05-22 | Satoshi Kobayashi | Relaying Apparatus and Network System |
US7697524B2 (en) * | 2005-04-05 | 2010-04-13 | Cisco Technology, Inc. | Method and system for determining path maximum transfer unit for IP multicast |
US20060221844A1 (en) * | 2005-04-05 | 2006-10-05 | Cisco Technology, Inc. | Method and system for determining path maximum transfer unit for IP multicast |
US10044748B2 (en) | 2005-10-27 | 2018-08-07 | Georgia Tech Research Corporation | Methods and systems for detecting compromised computers |
US20120137366A1 (en) * | 2005-11-14 | 2012-05-31 | Cisco Technology, Inc. | Techniques for network protection based on subscriber-aware application proxies |
US8844035B2 (en) * | 2005-11-14 | 2014-09-23 | Cisco Technology, Inc. | Techniques for network protection based on subscriber-aware application proxies |
US20080147847A1 (en) * | 2006-12-15 | 2008-06-19 | Fraudwall Technologies, Inc. | Network interaction analysis |
US10235677B1 (en) | 2006-12-15 | 2019-03-19 | Comscore, Inc. | Determination and application of click quality |
US20080147499A1 (en) * | 2006-12-15 | 2008-06-19 | Fraudwall Technologies, Inc. | Network interaction correlation |
US9412111B2 (en) | 2006-12-15 | 2016-08-09 | Comscore, Inc. | Network interaction monitoring appliance |
US20080189409A1 (en) * | 2006-12-15 | 2008-08-07 | Fraudwall Technologies, Inc. | Network interaction monitoring appliance |
US7685275B2 (en) * | 2006-12-15 | 2010-03-23 | Anchor Intelligence, Inc. | Network interaction analysis |
US8990379B2 (en) | 2006-12-15 | 2015-03-24 | Comscore, Inc. | Network interaction monitoring appliance |
US10402832B2 (en) | 2006-12-15 | 2019-09-03 | Comscore, Inc. | Network interaction correlation |
US20080183623A1 (en) * | 2007-01-29 | 2008-07-31 | Zhangwei Xu | Secure Provisioning with Time Synchronization |
US8867385B2 (en) * | 2007-05-14 | 2014-10-21 | Cisco Technology, Inc. | Tunneling reports for real-time Internet Protocol media streams |
US20110191469A1 (en) * | 2007-05-14 | 2011-08-04 | Cisco Technology, Inc. | Tunneling reports for real-time internet protocol media streams |
US20090037208A1 (en) * | 2007-08-03 | 2009-02-05 | Fraudwall Technologies, Inc. | Using a reason code to indicate a reason for a rating of a network interaction |
US8966551B2 (en) | 2007-11-01 | 2015-02-24 | Cisco Technology, Inc. | Locating points of interest using references to media frames within a packet flow |
US20090119722A1 (en) * | 2007-11-01 | 2009-05-07 | Versteeg William C | Locating points of interest using references to media frames within a packet flow |
US9762640B2 (en) | 2007-11-01 | 2017-09-12 | Cisco Technology, Inc. | Locating points of interest using references to media frames within a packet flow |
US8806053B1 (en) | 2008-04-29 | 2014-08-12 | F5 Networks, Inc. | Methods and systems for optimizing network traffic using preemptive acknowledgment signals |
US10027688B2 (en) | 2008-08-11 | 2018-07-17 | Damballa, Inc. | Method and system for detecting malicious and/or botnet-related domain names |
US8868961B1 (en) | 2009-11-06 | 2014-10-21 | F5 Networks, Inc. | Methods for acquiring hyper transport timing and devices thereof |
US10721269B1 (en) | 2009-11-06 | 2020-07-21 | F5 Networks, Inc. | Methods and system for returning requests with javascript for clients before passing a request to a server |
US11108815B1 (en) | 2009-11-06 | 2021-08-31 | F5 Networks, Inc. | Methods and system for returning requests with javascript for clients before passing a request to a server |
WO2011066509A3 (en) * | 2009-11-30 | 2011-10-13 | Citrix Systems, Inc. | Systems and methods for aggressive window probing |
US20110131654A1 (en) * | 2009-11-30 | 2011-06-02 | Varun Taneja | Systems and methods for aggressive window probing |
US8387143B2 (en) | 2009-11-30 | 2013-02-26 | Citrix Systems, Inc. | Systems and methods for aggressive window probing |
US8875290B2 (en) | 2009-11-30 | 2014-10-28 | Citrix Systems, Inc. | Systems and methods for aggressive window probing |
WO2011066509A2 (en) * | 2009-11-30 | 2011-06-03 | Citrix Systems, Inc. | Systems and methods for aggressive window probing |
US10257212B2 (en) | 2010-01-06 | 2019-04-09 | Help/Systems, Llc | Method and system for detecting malware |
US9948671B2 (en) | 2010-01-19 | 2018-04-17 | Damballa, Inc. | Method and system for network-based detecting of malware from behavioral clustering |
US9141625B1 (en) | 2010-06-22 | 2015-09-22 | F5 Networks, Inc. | Methods for preserving flow state during virtual machine migration and devices thereof |
US10015286B1 (en) | 2010-06-23 | 2018-07-03 | F5 Networks, Inc. | System and method for proxying HTTP single sign on across network domains |
US8908545B1 (en) | 2010-07-08 | 2014-12-09 | F5 Networks, Inc. | System and method for handling TCP performance in network access with driver initiated application tunnel |
USRE47019E1 (en) | 2010-07-14 | 2018-08-28 | F5 Networks, Inc. | Methods for DNSSEC proxying and deployment amelioration and systems thereof |
US9083760B1 (en) | 2010-08-09 | 2015-07-14 | F5 Networks, Inc. | Dynamic cloning and reservation of detached idle connections |
US8886981B1 (en) | 2010-09-15 | 2014-11-11 | F5 Networks, Inc. | Systems and methods for idle driven scheduling |
US8804504B1 (en) | 2010-09-16 | 2014-08-12 | F5 Networks, Inc. | System and method for reducing CPU load in processing PPP packets on a SSL-VPN tunneling device |
US9554276B2 (en) | 2010-10-29 | 2017-01-24 | F5 Networks, Inc. | System and method for on the fly protocol conversion in obtaining policy enforcement information |
US8959571B2 (en) | 2010-10-29 | 2015-02-17 | F5 Networks, Inc. | Automated policy builder |
US10135831B2 (en) | 2011-01-28 | 2018-11-20 | F5 Networks, Inc. | System and method for combining an access control system with a traffic management system |
US9246819B1 (en) | 2011-06-20 | 2016-01-26 | F5 Networks, Inc. | System and method for performing message-based load balancing |
US9270766B2 (en) * | 2011-12-30 | 2016-02-23 | F5 Networks, Inc. | Methods for identifying network traffic characteristics to correlate and manage one or more subsequent flows and devices thereof |
TWI582584B (en) * | 2011-12-30 | 2017-05-11 | F5網路公司 | Methods for identifying network traffic characteristics to correlate and manage one or more subsequent flows and devices thereof |
US9985976B1 (en) | 2011-12-30 | 2018-05-29 | F5 Networks, Inc. | Methods for identifying network traffic characteristics to correlate and manage one or more subsequent flows and devices thereof |
US9922190B2 (en) | 2012-01-25 | 2018-03-20 | Damballa, Inc. | Method and system for detecting DGA-based malware |
US10230566B1 (en) | 2012-02-17 | 2019-03-12 | F5 Networks, Inc. | Methods for dynamically constructing a service principal name and devices thereof |
US9172753B1 (en) | 2012-02-20 | 2015-10-27 | F5 Networks, Inc. | Methods for optimizing HTTP header based authentication and devices thereof |
US9231879B1 (en) | 2012-02-20 | 2016-01-05 | F5 Networks, Inc. | Methods for policy-based network traffic queue management and devices thereof |
US10097616B2 (en) | 2012-04-27 | 2018-10-09 | F5 Networks, Inc. | Methods for optimizing service of content requests and devices thereof |
US10547674B2 (en) | 2012-08-27 | 2020-01-28 | Help/Systems, Llc | Methods and systems for network flow analysis |
US10084806B2 (en) | 2012-08-31 | 2018-09-25 | Damballa, Inc. | Traffic simulation to identify malicious activity |
US9894088B2 (en) | 2012-08-31 | 2018-02-13 | Damballa, Inc. | Data mining to identify malicious activity |
US9306958B2 (en) * | 2012-09-06 | 2016-04-05 | Dstillery, Inc. | Methods, systems and media for detecting non-intended traffic using co-visitation information |
US20140351931A1 (en) * | 2012-09-06 | 2014-11-27 | Dstillery, Inc. | Methods, systems and media for detecting non-intended traffic using co-visitation information |
US10375155B1 (en) | 2013-02-19 | 2019-08-06 | F5 Networks, Inc. | System and method for achieving hardware acceleration for asymmetric flow connections |
US8978138B2 (en) | 2013-03-15 | 2015-03-10 | Mehdi Mahvi | TCP validation via systematic transmission regulation and regeneration |
US9197362B2 (en) | 2013-03-15 | 2015-11-24 | Mehdi Mahvi | Global state synchronization for securely managed asymmetric network communication |
US20170230393A1 (en) * | 2013-06-14 | 2017-08-10 | Damballa, Inc. | Systems and methods for traffic classification |
US10050986B2 (en) * | 2013-06-14 | 2018-08-14 | Damballa, Inc. | Systems and methods for traffic classification |
US10187317B1 (en) | 2013-11-15 | 2019-01-22 | F5 Networks, Inc. | Methods for traffic rate control and devices thereof |
US10015143B1 (en) | 2014-06-05 | 2018-07-03 | F5 Networks, Inc. | Methods for securing one or more license entitlement grants and devices thereof |
US11838851B1 (en) | 2014-07-15 | 2023-12-05 | F5, Inc. | Methods for managing L7 traffic classification and devices thereof |
US10122630B1 (en) | 2014-08-15 | 2018-11-06 | F5 Networks, Inc. | Methods for network traffic presteering and devices thereof |
US9854000B2 (en) * | 2014-11-06 | 2017-12-26 | Cisco Technology, Inc. | Method and apparatus for detecting malicious software using handshake information |
US20160134646A1 (en) * | 2014-11-06 | 2016-05-12 | Cisco Technology, Inc. | Method and apparatus for detecting malicious software using handshake information |
US10182013B1 (en) | 2014-12-01 | 2019-01-15 | F5 Networks, Inc. | Methods for managing progressive image delivery and devices thereof |
US11895138B1 (en) | 2015-02-02 | 2024-02-06 | F5, Inc. | Methods for improving web scanner accuracy and devices thereof |
US9930065B2 (en) | 2015-03-25 | 2018-03-27 | University Of Georgia Research Foundation, Inc. | Measuring, categorizing, and/or mitigating malware distribution paths |
US10834065B1 (en) | 2015-03-31 | 2020-11-10 | F5 Networks, Inc. | Methods for SSL protected NTLM re-authentication and devices thereof |
US10505818B1 (en) | 2015-05-05 | 2019-12-10 | F5 Networks. Inc. | Methods for analyzing and load balancing based on server health and devices thereof |
US11350254B1 (en) | 2015-05-05 | 2022-05-31 | F5, Inc. | Methods for enforcing compliance policies and devices thereof |
US11757946B1 (en) | 2015-12-22 | 2023-09-12 | F5, Inc. | Methods for analyzing network traffic and enforcing network policies and devices thereof |
US10404698B1 (en) | 2016-01-15 | 2019-09-03 | F5 Networks, Inc. | Methods for adaptive organization of web application access points in webtops and devices thereof |
US10797888B1 (en) | 2016-01-20 | 2020-10-06 | F5 Networks, Inc. | Methods for secured SCEP enrollment for client devices and devices thereof |
US11178150B1 (en) | 2016-01-20 | 2021-11-16 | F5 Networks, Inc. | Methods for enforcing access control list based on managed application and devices thereof |
US10791088B1 (en) | 2016-06-17 | 2020-09-29 | F5 Networks, Inc. | Methods for disaggregating subscribers via DHCP address translation and devices thereof |
US11063758B1 (en) | 2016-11-01 | 2021-07-13 | F5 Networks, Inc. | Methods for facilitating cipher selection and devices thereof |
US10505792B1 (en) | 2016-11-02 | 2019-12-10 | F5 Networks, Inc. | Methods for facilitating network traffic analytics and devices thereof |
US10708294B2 (en) * | 2017-01-19 | 2020-07-07 | Arbor Networks, Inc. | System and method to select and apply hypothetical mitigation parameters |
US10812266B1 (en) | 2017-03-17 | 2020-10-20 | F5 Networks, Inc. | Methods for managing security tokens based on security violations and devices thereof |
US10972453B1 (en) | 2017-05-03 | 2021-04-06 | F5 Networks, Inc. | Methods for token refreshment based on single sign-on (SSO) for federated identity environments and devices thereof |
US11122042B1 (en) | 2017-05-12 | 2021-09-14 | F5 Networks, Inc. | Methods for dynamically managing user access control and devices thereof |
US11343237B1 (en) | 2017-05-12 | 2022-05-24 | F5, Inc. | Methods for managing a federated identity environment using security and access control data and devices thereof |
US11122083B1 (en) | 2017-09-08 | 2021-09-14 | F5 Networks, Inc. | Methods for managing network connections based on DNS data and network policies and devices thereof |
US10868828B2 (en) * | 2018-03-19 | 2020-12-15 | Fortinet, Inc. | Mitigation of NTP amplification and reflection based DDoS attacks |
US11044200B1 (en) | 2018-07-06 | 2021-06-22 | F5 Networks, Inc. | Methods for service stitching using a packet header and devices thereof |
Also Published As
Publication number | Publication date |
---|---|
US7657934B2 (en) | 2010-02-02 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7657934B2 (en) | Architecture to thwart denial of service attacks | |
US7213264B2 (en) | Architecture to thwart denial of service attacks | |
US7743415B2 (en) | Denial of service attacks characterization | |
US7278159B2 (en) | Coordinated thwarting of denial of service attacks | |
US7581023B2 (en) | Architecture to thwart denial of service attacks | |
US7043759B2 (en) | Architecture to thwart denial of service attacks | |
US7124440B2 (en) | Monitoring network traffic denial of service attacks | |
US7398317B2 (en) | Thwarting connection-based denial of service attacks | |
US7743134B2 (en) | Thwarting source address spoofing-based denial of service attacks | |
US7836498B2 (en) | Device to protect victim sites during denial of service attacks | |
US7702806B2 (en) | Statistics collection for network traffic | |
US7301899B2 (en) | Prevention of bandwidth congestion in a denial of service or other internet-based attack | |
US6578147B1 (en) | Parallel intrusion detection sensors with load balancing for high speed networks | |
US6954775B1 (en) | Parallel intrusion detection sensors with load balancing for high speed networks | |
US8239942B2 (en) | Parallel intrusion detection sensors with load balancing for high speed networks | |
US7359962B2 (en) | Network security system integration | |
US7389537B1 (en) | Rate limiting data traffic in a network | |
CN108063765B (en) | SDN system suitable for solving network security | |
US20040148520A1 (en) | Mitigating denial of service attacks | |
US7467408B1 (en) | Method and apparatus for capturing and filtering datagrams for network security monitoring | |
Mano et al. | RIPPS: Rogue identifying packet payload slicer detecting unauthorized wireless hosts through network traffic conditioning | |
US20040250158A1 (en) | System and method for protecting an IP transmission network against the denial of service attacks | |
de Andrade | An Efficient Intrusion Detection System for Networks with Centralized Routing |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: MAZU NETWORKS, INC., MASSACHUSETTS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:POLETTO, MASSIMILIANO ANTONIO;DUDFIELD, ANNE ELIZABETH;REEL/FRAME:022344/0013 Effective date: 20020125 Owner name: MAZU NETWORKS, INC.,MASSACHUSETTS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:POLETTO, MASSIMILIANO ANTONIO;DUDFIELD, ANNE ELIZABETH;REEL/FRAME:022344/0013 Effective date: 20020125 |
|
AS | Assignment |
Owner name: MAZU NETWORKS, LLC, MASSACHUSETTS Free format text: CHANGE OF NAME;ASSIGNOR:MAZU NETWORKS, INC.;REEL/FRAME:022460/0886 Effective date: 20090220 Owner name: MAZU NETWORKS, LLC,MASSACHUSETTS Free format text: CHANGE OF NAME;ASSIGNOR:MAZU NETWORKS, INC.;REEL/FRAME:022460/0886 Effective date: 20090220 |
|
AS | Assignment |
Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MAZU NETWORKS, LLC;REEL/FRAME:022542/0800 Effective date: 20090413 Owner name: RIVERBED TECHNOLOGY, INC.,CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MAZU NETWORKS, LLC;REEL/FRAME:022542/0800 Effective date: 20090413 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
CC | Certificate of correction | ||
CC | Certificate of correction | ||
FEPP | Fee payment procedure |
Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
AS | Assignment |
Owner name: MORGAN STANLEY & CO. LLC, MARYLAND Free format text: SECURITY AGREEMENT;ASSIGNORS:RIVERBED TECHNOLOGY, INC.;OPNET TECHNOLOGIES, INC.;REEL/FRAME:029646/0060 Effective date: 20121218 |
|
FPAY | Fee payment |
Year of fee payment: 4 |
|
AS | Assignment |
Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: RELEASE OF PATENT SECURITY INTEREST;ASSIGNOR:MORGAN STANLEY & CO. LLC, AS COLLATERAL AGENT;REEL/FRAME:032113/0425 Effective date: 20131220 |
|
AS | Assignment |
Owner name: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT, NEW YORK Free format text: PATENT SECURITY AGREEMENT;ASSIGNOR:RIVERBED TECHNOLOGY, INC.;REEL/FRAME:032421/0162 Effective date: 20131220 Owner name: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT Free format text: PATENT SECURITY AGREEMENT;ASSIGNOR:RIVERBED TECHNOLOGY, INC.;REEL/FRAME:032421/0162 Effective date: 20131220 |
|
AS | Assignment |
Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:BARCLAYS BANK PLC;REEL/FRAME:035521/0069 Effective date: 20150424 |
|
AS | Assignment |
Owner name: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT, NEW YORK Free format text: SECURITY INTEREST;ASSIGNOR:RIVERBED TECHNOLOGY, INC.;REEL/FRAME:035561/0363 Effective date: 20150424 Owner name: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL Free format text: SECURITY INTEREST;ASSIGNOR:RIVERBED TECHNOLOGY, INC.;REEL/FRAME:035561/0363 Effective date: 20150424 |
|
AS | Assignment |
Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE CONVEYING PARTY NAME PREVIOUSLY RECORDED ON REEL 035521 FRAME 0069. ASSIGNOR(S) HEREBY CONFIRMS THE RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:JPMORGAN CHASE BANK, N.A.;REEL/FRAME:035807/0680 Effective date: 20150424 |
|
FPAY | Fee payment |
Year of fee payment: 8 |
|
AS | Assignment |
Owner name: ALTER DOMUS (US) LLC, AS COLLATERAL AGENT, ILLINOIS Free format text: PATENT SECURITY AGREEMENT;ASSIGNOR:RIVERBED TECHNOLOGY, INC.;REEL/FRAME:055514/0249 Effective date: 20201231 |
|
AS | Assignment |
Owner name: MACQUARIE CAPITAL FUNDING LLC, NEW YORK Free format text: SECURITY INTEREST;ASSIGNORS:RIVERBED HOLDINGS, INC.;RIVERBED TECHNOLOGY, INC.;ATERNITY LLC;REEL/FRAME:056397/0750 Effective date: 20210420 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 12 |
|
AS | Assignment |
Owner name: ATERNITY LLC, CALIFORNIA Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORED AT REEL 056397, FRAME 0750;ASSIGNOR:MACQUARIE CAPITAL FUNDING LLC;REEL/FRAME:057983/0356 Effective date: 20211012 Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORED AT REEL 056397, FRAME 0750;ASSIGNOR:MACQUARIE CAPITAL FUNDING LLC;REEL/FRAME:057983/0356 Effective date: 20211012 Owner name: RIVERBED HOLDINGS, INC., CALIFORNIA Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORED AT REEL 056397, FRAME 0750;ASSIGNOR:MACQUARIE CAPITAL FUNDING LLC;REEL/FRAME:057983/0356 Effective date: 20211012 |
|
AS | Assignment |
Owner name: ALTER DOMUS (US) LLC, AS COLLATERAL AGENT, ILLINOIS Free format text: PATENT SECURITY AGREEMENT SUPPLEMENT - SECOND LIEN;ASSIGNORS:RIVERBED HOLDINGS, INC.;RIVERBED TECHNOLOGY, INC.;ATERNITY LLC;REEL/FRAME:057810/0559 Effective date: 20211013 Owner name: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT, MARYLAND Free format text: PATENT SECURITY AGREEMENT SUPPLEMENT - FIRST LIEN;ASSIGNORS:RIVERBED HOLDINGS, INC.;RIVERBED TECHNOLOGY, INC.;ATERNITY LLC;REEL/FRAME:057810/0502 Effective date: 20211013 |
|
AS | Assignment |
Owner name: WILMINGTON TRUST, NATIONAL ASSOCIATION, MINNESOTA Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:RIVERBED TECHNOLOGY, INC.;ATERNITY LLC;REEL/FRAME:057943/0386 Effective date: 20211013 |
|
AS | Assignment |
Owner name: WILMINGTON TRUST, NATIONAL ASSOCIATION, AS U.S. COLLATERAL AGENT, MINNESOTA Free format text: SECURITY INTEREST;ASSIGNORS:RIVERBED TECHNOLOGY LLC (FORMERLY RIVERBED TECHNOLOGY, INC.);ATERNITY LLC;REEL/FRAME:058486/0216 Effective date: 20211207 |
|
AS | Assignment |
Owner name: ATERNITY LLC, MASSACHUSETTS Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:WILMINGTON TRUST, NATIONAL ASSOCIATION, AS U.S. COLLATERAL AGENT;REEL/FRAME:058593/0169 Effective date: 20211207 Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:WILMINGTON TRUST, NATIONAL ASSOCIATION, AS U.S. COLLATERAL AGENT;REEL/FRAME:058593/0169 Effective date: 20211207 Owner name: ATERNITY LLC, MASSACHUSETTS Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:ALTER DOMUS (US) LLC, AS COLLATERAL AGENT;REEL/FRAME:058593/0108 Effective date: 20211207 Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:ALTER DOMUS (US) LLC, AS COLLATERAL AGENT;REEL/FRAME:058593/0108 Effective date: 20211207 Owner name: ATERNITY LLC, MASSACHUSETTS Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT;REEL/FRAME:058593/0046 Effective date: 20211207 Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENTS;ASSIGNOR:MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT;REEL/FRAME:058593/0046 Effective date: 20211207 |
|
AS | Assignment |
Owner name: RIVERBED TECHNOLOGY LLC, CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:RIVERBED TECHNOLOGY, INC.;REEL/FRAME:059232/0551 Effective date: 20211207 |
|
AS | Assignment |
Owner name: RIVERBED HOLDINGS, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC, AS COLLATERAL AGENT;REEL/FRAME:064673/0739 Effective date: 20211207 Owner name: ATERNITY LLC, MASSACHUSETTS Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC, AS COLLATERAL AGENT;REEL/FRAME:064673/0739 Effective date: 20211207 Owner name: RIVERBED TECHNOLOGY, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC, AS COLLATERAL AGENT;REEL/FRAME:064673/0739 Effective date: 20211207 |